app[.]soil[.]co

The domain app.soil.co was identified as a phishing site engaging in brand impersonation, specifically targeting the brand Polygon. The site has been taken offline, reducing its immediate threat. However, when it was active, it was part of a cryptocurrency scam, posing risks to users interacting with it. This domain is not safe and was designed to deceive users by mimicking a legitimate brand.

Technical indicators for app.soil.co include its detection by 1 of 95 security vendors on VirusTotal, notably flagged by Gridinsoft. The domain was registered through Ascio Technologies, Inc. Danmark - Filial af Ascio technologies, Inc. USA, and was created on July 20, 2010. It resolves to IP address 2606:4700:20::681a:1d8 and is listed on one security blocklist, PhishDestroy. The SSL certificate was issued by Google Trust Services / WE1, and the site used technologies such as Amazon Web Services, Typekit, and Cloudflare.

For those who interacted with app.soil.co, it is crucial to take immediate safety steps. If engaged in cryptocurrency transactions, users should revoke token approvals and move funds to a secure wallet. For those who may have entered credentials, it is advised to change passwords, enable two-factor authentication, and monitor accounts for any fraudulent activity. To report phishing incidents, users can contact local cybersecurity authorities or use platforms like PhishDestroy to flag suspicious domains.